RDAP vs. WHOIS: The January 28, 2025 gTLD Sunset & GDPR Redaction
For decades, port-43 WHOIS (RFC 3912) was the primary directory protocol for querying domain name registrations and IP address allocations. On January 28, 2025, ICANN officially sunset the requirement for generic top-level domain (gTLD) registries and registrars to operate legacy WHOIS services, making RDAP (Registration Data Access Protocol) the authoritative standard for gTLD registration data.
Why RDAP Replaced Legacy WHOIS
Legacy WHOIS returns unstructured, free-form plain text over TCP port 43 with no standardized field names, no character encoding guarantees, and no built-in authentication. RDAP (standardized by the IETF in RFCs 7480–7484 and RFC 9082/9083) solves these limitations:
| Feature | Legacy Port-43 WHOIS | RDAP (Registration Data Access Protocol) |
|---|---|---|
| Transport | Unencrypted TCP Port 43 | HTTPS (RESTful URLs over TLS) |
| Output Format | Unstructured plain text (varies by registrar) | Standardized machine-readable JSON |
| Internationalization | Inconsistent ASCII / legacy encodings | Native UTF-8 & IDN support |
| Bootstrapping | Hardcoded server lists or referral parsing | IANA RDAP Bootstrap registries redirect queries automatically |
| ICANN gTLD Mandate | Obligation ended January 28, 2025 | Mandatory primary directory service for gTLDs |
Why Registrant Contact Fields Are Redacted (GDPR)
When you look up most domains today, personal contact fields—such as the Registrant Name, Street Address, Phone Number, and Email—appear as REDACTED FOR PRIVACY or are omitted from the RDAP JSON response entirely.
Following the European Union's General Data Protection Regulation (GDPR) in May 2018 and ICANN's Temporary Specification (later formalized into the ICANN Registration Data Policy), registrars and registries mask personal registrant data by default in public WHOIS and RDAP responses to protect individual privacy and prevent spam/harassment.
What remains public in RDAP and WHOIS?
- Domain name and Registry Domain ID
- Sponsoring Registrar name, IANA ID, and abuse contact email/phone
- Creation date, last updated timestamp, and registry expiration date
- EPP domain status codes (e.g.,
clientTransferProhibited) - Authoritative Name Servers and DNSSEC delegation status
How to Request Non-Public Data via ICANN RDRS
Law enforcement, intellectual property attorneys, cybersecurity researchers, and parties with a legitimate legal interest can submit formal disclosure requests for redacted gTLD registration data through ICANN's centralized Registration Data Request Service (RDRS):
Visit ICANN RDRS (rdrs.icann.org) →
Note: ICANN RDRS routes standardized disclosure requests to participating ICANN-accredited registrars, who evaluate each request independently under applicable data protection laws.